Anomaly detection systems can analyze data for a computer to determine whether a process executing on the computer is acting anomalous. Anomaly detection systems may determine whether a process should be evaluated for the presence of anomalous or malicious activity. Alternatively, anomaly detection systems may determine whether a process is anomalous, malicious, or both, and, if so, perform a corrective action. Anomaly detection systems may terminate an anomalous process or analyze the process in further detail.